Re: [openpgp] Recap of the signature options [was: PQC signature algorithm selection]

[Falko Strenzke <[e-mail]>]

Am 05.03.24 um 00:47 schrieb Simon Josefsson:
> The intention seems to achieve a SV property, am I reading this right?

No, at least not in my view. Could you please state what concrete threat 
should be thwarted by achieving simultaneous-verification (SV) in OpenPGP?

I personally cannot think of any system where achieving SV brings a 
benefit over strong non-separability. SV seems to attempt (that's a 
fact, it can't ensure, see further down) to prevent the verifier from 
aborting the signature verification after having verified only one 
signature. What I don't see is that the verifier ever needs to be or 
even can be protected from himself. If the verifier isn't a stakeholder 
for proper verification according to the protocol specifications, then 
how should a signature scheme that achieves SV prevent him from simply 
accepting just any signature without any signature verification at all? 
How is this principally different from verifying only one of the two 
signatures?

>
> I would feel more comfortable if PGP relied on a hybrid signature
> combiner scheme that offered SV as a cryptographic property rather than
> as a somewhat implicit protocol property.  And one that were specified
> generally and not just for PGP.
>
> One such scheme could be designed by replacing the two-part component
> signature values with just one value that is:
>
>     SHA3(Ed25519.signature
>          || Ed25519.publickey
>          || ML-DSA-87.signature
>          || ML-DSA-87.publickey
>          || context)

Can you please explain or reference this combiner? What is the signature 
creation, what the verification routine? You cannot possibly mean that 
the hash value replaces the signature because obviously there is no way 
for the verifier to compute the signatures...

- Falko

>
> and the verifier has to compare the computed signature against that
> value before being able to say ACK or NAK.
>
> I may be missing something fundamental here, so a question: Are there
> any fundamental reasons why a hybrid PQ/T signature scheme for PGP
> cannot rely on a opaque signature combiner (like the one that I
> suggested above, only better) that provides a SV guarantee?  Reversely:
> is there any reason PGP must use the separable two-value approach in
> section 6.3.1 of draft-ietf-openpgp-pqc?

Why do you claim it was separable? It is not separable because OpenPGP 
hashes the signature algorithm ID as part as meta data in the message 
digest calculation.

- Falko

>
> /Simon
>
> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp
-- 

*MTG AG*
Dr. Falko Strenzke
Executive System Architect

Phone: [phone]
E-Mail: [e-mail]
Web: mtg.de <https://www.mtg.de>

<https://www.linkedin.com/search/results/all/?fetchDeterministicClustersOnly=true&heroEntityKey=urn%3Ali%3Aorganization%3A13983133&keywords=mtg%20ag&origin=RICH_QUERY_SUGGESTION&position=0&searchId=d5bc71c3-97f7-4cae-83e7-e9e16d497dc2&sid=3S5&spellCorrectionEnabled=false>
Follow us
------------------------------------------------------------------------
<https://www.mtg.de/de/aktuelles/MTG-AG-erhaelt-Innovationspreis-des-Bundesverbands-IT-Sicherheit-e.V-00001.-TeleTrust/> 
<https://www.itsa365.de/de-de/companies/m/mtg-ag>

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>